icannTLD Zeek script¶
icannTLD is a Zeek script that uses the official ICANN Top-Level Domain (TLD) list to extract the relevant information from a DNS query and enrich the DNS log with that information. It can also mark whether it’s trusted or not. The source of the ICANN TLDs can be found here: https://publicsuffix.org/list/effective_tld_names.dat.
Today, anyone can create a TLD and ICANN updates the list several times a day, as changes are made.
TLDs are generally split into two categories:
ccTLDs are Country Code TLDs, such as .us, .jp and .uk
gTLDs are Generic TLDs and include the traditional names .com, .net, and .org. Generic TLDs also include the new TLDs such as .info, .city, .microsoft, etc.
- As of December 2022, there are 6887 Top-Level Domains that can include up to 4 parts.
19.2% (1,322) TLDs only contain one part (i.e. .com)
52.2% (3,597) TLDs contain two parts (i.e. mo.us)
28.5% (1,964) TLDs contain three parts (i.e. k12.mo.us)
0.1% (4) TLDs contain four parts (i.e. pvt.k12.ma.us)
As a result, any method of identifying TLDs without using the ICANN TLD database, i.e. regex, will miss identify over 80% of them.
Tip
The Trusted Domains list is a custom list, created by the user, to filter domains during searches.
Script functions¶
icannTLD parses every DNS query and adds the following fields to the DNS Log.
Field | Value | Description |
---|---|---|
icann_tld | This is the Top-Level Domain based on the official list of TLDs from ICANN. | |
icann_domain | This is the Domain based on the official list of TLDs from ICANN. | |
icann_host_subdomain | This is the remaining nodes of the query after the domain has been removed. In some cases this is the subdomain, in other cases it’s the host name, and in others it’s host name and subdomain. | |
is_trusted_domain | true/false | Each query is marked true or false based on the icann_domain and a custom trusted_domains.dat file. |
Corelight-update can generate the required Input files needed for the icannTLD Zeek script. However, the optional trusted domain list is not generated. See https://github.com/corelight/icannTLD for more details.
If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See Configuration settings
The icannTLD settings:
icann_tld: enabled: true interval_hours: 0 url: "https://publicsuffix.org/list/effective_tld_names.dat"